Hack My Website

About the startup

Most apps today are shipped fast with Cursor, Lovable, Bolt, Replit, or v0 — and they inherit the same predictable security blind spots: exposed source maps, weak cookies, unprotected admin routes, hardcoded secrets, and unauthenticated API endpoints. Founders and small teams rarely have an in-house security engineer to catch these before launch, and traditional penetration testing costs thousands of dollars and takes weeks to schedule. Hack My Website closes that gap. It's an automated web security scanning and AI-powered reporting platform that runs a real dynamic scanning pipeline — OWASP ZAP, Nuclei, and Semgrep — against your live site, then hands the raw findings to Google Gemini to translate them into a plain-English report and a 0-100 AI Launch Score. A typical scan completes in 3-8 minutes. What makes it different from a raw scanner dump: Verified-domain scanning only. You prove ownership via DNS TXT record or a .well-known file before any scan runs — no scanning of sites you don't own, and no risk of your own site being scanned by someone else. Developer-ready output, not a security report you need a consultant to interpret. Each finding includes severity, business impact, a concrete fix suggestion, and copy-paste "handoff prompts" formatted for Cursor or Claude, so an AI coding assistant can implement the fix directly. Retesting built in. Fix a vulnerability, click retest, and the platform re-verifies the specific issue is closed — no re-running a full scan. GitHub repository review. Beyond live URL scanning, it can review a connected repository snapshot for committed secrets (API keys, tokens), outdated/insecure dependencies, and unprotected API routes. Framework-aware checks. Includes specific probes for common Next.js and Supabase misconfigurations (e.g., unauthenticated Server Actions, missing Row-Level Security). GraphQL introspection and OpenAPI/Postman fuzzing for teams exposing GraphQL or documented REST APIs. Who it's for: AI-first indie founders, bootstrapped startup teams, freelance web developers, and digital agencies shipping client sites who need a fast, affordable "is this safe to launch" signal — not an enterprise VAPT engagement. Plans: Free — 1 verified domain, 1 scan/month, basic report. Pro — up to 3 domains, 30 scans/month, weekly recurring monitoring. Agency — up to 10 domains, 150 scans/month, white-labeled PDF reports for client delivery. Security-first by design: every scan enforces SSRF protections (no localhost, private, or internal network targets accepted), strict per-user data isolation, and scanner concurrency limits — so the platform itself follows the same security discipline it checks for. Built on Next.js, FastAPI, Celery/Redis for the scan pipeline, and Google Gemini for the AI report layer, with results stored per-user in a dedicated database and exportable as a signed, shareable PDF. If you've shipped something fast and you're not sure what's actually exposed, run a scan before your first real user does.